CVE-2024-11582

Summary

CVE-2024-11582 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress. The issue lies in the insufficient input sanitization and output escaping of the ip parameter, which can be exploited by unauthenticated attackers. The consequence of this vulnerability is the injection of arbitrary web scripts into pages, causing them to execute whenever a user accesses an injected page. All versions of the plugin up to and including 10.43 are reportedly impacted by this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.